iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Deception Mesh is an open-source Rust MVP that records activity against decoy HTTP and SSH services, then turns those interactions into events an operator can review, export, or route to a webhook. It is designed for observation and triage—not to block attacks or act as a complete security platform. The project page describes its implementation and explicitly lists security work that remains unfinished.
What Deception Mesh does
The project presents Deception Mesh as a defensive telemetry system: sensors expose decoy services, capture activity such as a source IP, requested route, or attempted login, and report that activity for operator review. Its HTTP traps include routes such as /login, /admin, and /wp-login.php. The SSH honeypot is described as having no real shell. In other words, the decoys are intended to record suspicious interactions, not provide a working service or a means to counterattack. TuCodigoCotidiano’s project page describes the software as an MVP for early suspicious-activity telemetry.
The project describes rule-based severity and handling for repeated activity. These features can help prioritize events, but the published material does not provide a measured detection rate, threat-volume analysis, or evidence that using the system reduces incidents.
How the documented architecture fits together
The documented flow is sensor agent → central control plane → PostgreSQL → operator queries, exports, or notifications. The stack listed on the project page includes Rust, Axum, Tokio, PostgreSQL, Docker, JWT, and role-based access control (RBAC).
#1 Best Overall
- Sensors: Run the HTTP and SSH decoys, capture interactions, and send events to the control plane. The project also describes enrollment tokens and heartbeats for sensor status.
- Control plane: Validates authentication, applies tenant RBAC, persists events, and manages webhook delivery.
- PostgreSQL: Stores events, audit records, heartbeats, and sensor state.
- Operator outputs: The documented capabilities include queries, CSV export, and a webhook queue with retries and backoff.
The project names an EventV1 schema for event data. That gives the system a documented event format, but the project page does not establish a comparative evaluation of its fields or integrations against other tools.
What the project says is implemented—and what is not
The project page lists JWT for users, tenant RBAC, hashed sensor and enrollment tokens, Argon2 password verification, strict EventV1 validation, administrative audit, and webhook delivery history and retries as implemented controls. Those are descriptions of the project’s implementation, not the results of an independent security audit.
The same page identifies several gaps that matter when deciding whether to deploy it beyond a lab or pilot:
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →- Sensor mutual TLS (mTLS) is not implemented.
- Automatic per-tenant data retention is not implemented.
- Formal token rotation is not implemented.
- A
/metricsendpoint is not implemented.
The project says development or local mode accepts HTTP and that production should use real HTTPS. It also cautions against describing the MVP as fully hardened for production. The published material does not report a penetration test, reliability measurements, deployment benchmarks, or a security assessment, so the listed controls should not be treated as proof of those properties.
Rank #3
How to try the documented MVP
The project page provides a local quickstart and a manual Docker Compose demo. It also sketches a separate VPS deployment sequence. These are documented workflows; they do not by themselves establish that a deployment is production-ready.
Local quickstart
- Run the project’s local installation script:
scripts/t29_install_mvp_local.sh. - Run the end-to-end quickstart script:
scripts/e2e_t29_quickstart.sh.
Manual Docker Compose demo
- Start PostgreSQL and the control plane with Docker Compose.
- Check the control plane’s
/healthand/readyendpoints. - Run
scripts/demo.shto exercise the demo flow.
Suggested VPS sequence
- Prepare production secrets.
- Build the images and start the control plane and database.
- Create an administrator and tenant.
- Register a sensor.
- Run a production smoke test.
Before using any of these workflows, consult the current project documentation and repository for the actual scripts, configuration, and deployment requirements. The project page available for this description predates October 2026, so it should not be read as confirmation of current release status.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Who it may suit
Deception Mesh is best understood as a compact project to examine or trial if you want to study how decoy HTTP and SSH activity can be collected into structured telemetry. Its documented components—sensors, a central control plane, PostgreSQL, and operator outputs—make the data path legible. A secondary article published by LavX News on July 9, 2026, also frames it as a defensive telemetry project with learning value, but does not independently verify the implementation.
Recommended Free Tools
For production security monitoring, assess the deployment against your own requirements for sensor-to-control-plane protection, token lifecycle, retention, observability, and operational testing. The public project description does not establish that Deception Mesh meets those requirements or that it is a substitute for broader security controls.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
